fix(ci): re-lock python bindings' internal path deps so version bumps don't break --locked

python/ is a standalone workspace release-plz does not manage, so a library
version bump (sqlite-core/sqlite-forensic) leaves python/Cargo.lock pinning the
old version and the bindings' `cargo clippy/maturin --locked` steps fail
("cannot update the lock file because --locked was passed"). Re-lock only those
two path deps to the current source version before the --locked steps; all
third-party crates (pyo3, …) stay locked so the wheel remains reproducible.

The supply-chain (cargo vet) freshness treadmill was already fixed for this
repo's own crates via the first-party `audit-as-crates-io = false` policy in
supply-chain/config.toml (commit 93a640d); cargo vet passes on both main and the
release PR branch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h4x0r

.github/workflows/python.yml

@@ -31,6 +31,14 @@ jobs:
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
+      # python/ is a standalone workspace that release-plz does not manage, so a
+      # library version bump (sqlite-core/sqlite-forensic) leaves python/Cargo.lock
+      # pinning the old version and breaks the --locked steps below. Re-lock only
+      # those two path deps to the current source version; every third-party crate
+      # (pyo3, …) stays locked, so the wheel remains reproducible.
+      - name: Sync bindings lockfile to current crate versions
+        working-directory: python
+        run: cargo update -p sqlite-core -p sqlite-forensic
       - name: clippy (bindings)
         working-directory: python
         run: cargo clippy --all-targets --locked -- -D warnings